{"uid":"cap_Kou-AdARgij9-FexISYwr","slug":"agent-payload-tools-hmac-signature-0d1c2dc3","name":"Agent Payload Tools – HMAC Signature","description":"Create or compare an HMAC using SHA-256, SHA-384, or SHA-512.","url":"https://api.agent-payload-tools.workers.dev/hmac","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"input":{"type":"string","default":"","description":"UTF-8 message to authenticate."},"secret":{"type":"string","minLength":1,"description":"HMAC secret for this call. It is not stored."},"algorithm":{"enum":["SHA-256","SHA-384","SHA-512"],"type":"string","description":"Digest algorithm. Defaults to SHA-256."},"expected_hex":{"type":"string","pattern":"^[0-9a-fA-F]*$","description":"Optional hexadecimal digest to compare in constant time."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_wku_gWQowgsSp488slHLG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Computes an HMAC digest (SHA-256/384/512) for a UTF-8 message using a caller-supplied secret, with optional constant-time verification against an expected hex digest.","exampleAgentPrompt":"Compute an HMAC-SHA-256 signature for the message 'order_id=12345&amount=99.99' using the secret 'my-webhook-secret-key', and check if it matches the expected digest 'a3f1b2c4...'","exampleUseCases":[{"title":"Webhook payload integrity check","prompt":"I received a webhook from Stripe with body 'event_id=evt_123&type=payment' and their signature header. Can you compute an HMAC-SHA-256 using my secret 'whsec_abc123' and verify it matches the hex digest 'deadbeef1234' in constant time?"},{"title":"API request signing for outbound calls","prompt":"Before I send this API request, sign the payload 'user_id=42&action=transfer&amount=500' with my secret key 'svc-signing-key-prod' using SHA-512 HMAC so I can include the digest in the Authorization header."},{"title":"Data integrity stamp for audit logs","prompt":"I'm writing audit log entries and need to prove they haven't been tampered with — compute an HMAC-SHA-384 over the string 'timestamp=2024-01-15T10:30:00Z&action=delete&actor=admin' using secret 'audit-log-secret'."}],"resultDescription":"Returns the HMAC hex digest of the input message computed with the specified algorithm and secret. If an expected_hex was provided, also returns a boolean indicating whether the computed digest matches in constant time (resistant to timing attacks). The secret is not stored or logged.","failureModes":["Missing or empty secret returns a 400/422 validation error","Invalid algorithm value (not SHA-256, SHA-384, or SHA-512) returns a validation error","Malformed expected_hex (non-hex characters) returns a pattern validation error","Empty input is allowed (computes HMAC of empty string) but may produce unexpected results","Payment failure or insufficient USDC balance returns a 402 response before processing"],"whenToPreferThis":"Choose this endpoint when an AI agent needs a deterministic, stateless HMAC computation without managing cryptographic libraries — especially useful for webhook verification, API request signing, or integrity checks inside an automated workflow. The constant-time comparison option makes it suitable for security-sensitive verification where timing attacks are a concern. Prefer over general-purpose code execution for simplicity and auditability.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:41:29.054Z","isFirstParty":false}